<div>
Brute force attack is a possibility. <br />
<br />
are there multiple usernames being tried? or just 1?<br />
<br />
Is this WIFI connected to your domain?
</div>


<div>
It is only one username being used at all 4 of our WAPS since this started.<br />
<br />
Yes, the wifi uses certificate based authentication to connect with our domain.<br />
That + a user's AD credentials allows access to the wifi.
</div>


<div>
is the domain portion correct or is both the username and domain incorrect?
</div>


<div>
The domain is correct though that portion doesn't need to be typed in usually when logging in to the wifi.<br />
The successful log ins from users show only their username in the log.
</div>


<div>
1. Not similar at all. It looks like some sort of ID like mentioned in the OP. It's been the same username as well since the beginning.<br />
<br />
2. Mobile devices and laptops/PCs<br />
<br />
3. The MAC address is in the username itself. 00-80-92-B3-A0-EB.<br />
Can I block this from the RADIUS server itself or is there a better way?
</div>


<div>
What type of WIFI access point are you using? If possible it is better to block it there before it gets past, that way it never gets to the point of trying to authenticate.<br />
<br />
Do you have multiple access points?<br />
<br />
you could search through the event logs for that mac address and see if that tells you anything?
</div>


<div>
There are 4 PakEdge WX-1 access points. All of which this ID is trying to authenticate with.<br />
I will have to check with a colleague on the login credentials for these as I've never logged into them before.<br />
<br />
I'll try blocking from there, check the logs and report back.
</div>


<div>
That MAC address maps to Silex technologies, so you can eliminate phones and such... Look for other devices like off brand printers, wireless to usb type boxes, or off brand USB to wifi adapters.
</div>


<div>
Thanks everyone, it turned out to be a laptop using a static IP and connecting to wifi.
</div>


<div>
<div class="content wysiwyg-content">
A user reported that the wifi would disconnect randomly.<br />
Checking the server logs, I see a strange username continuously trying to connect: domain\ABC-x-xx-xx-xx-xx-x<wbr />x-xx.<br />
It started earlier this week according to the logs.<br />
The SID shows S-1-0-0 which only means unknown from what I can tell so not too helpful.<br />
<br />
I'm guessing since this continuously trying to authenticate it could be causing the disconnect problems with other users.<br />
<br />
Any idea what this could be? Could it be an attack attempt?
</div>
</div>


A user reported that the wifi would disconnect randomly.
Checking the server logs, I see a strange username continuously trying to connect: domain\ABC-x-xx-xx-xx-xx-xx-xx.
It started earlier this week according to the logs.
The SID shows S-1-0-0 which only means unknown from what I can tell so not too helpful.

I'm guessing since this continuously trying to authenticate it could be causing the disconnect problems with other users.

Any idea what this could be? Could it be an attack attempt?

RADIUS - Unknown user name keeps attempting to authenticate

Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.

Windows Server 2008

The Windows operating systems have distinct methodologies for designing and implementing networks, and have specific systems to accomplish various networking processes, such as Exchange for email, Sharepoint for shared files and programs, and IIS for delivery of web pages. Microsoft also produces server technologies for networked database use, security and virtualization.

Windows Networking

Wireless networking is anything related to the transfer of data between two (or more) devices without the use of a physical connection, ranging from getting advice on a new Bluetooth headset to configuring sophisticated enterprise level networks.

Wireless Networking

Network security consists of the policies adopted to prevent and monitor authorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves the authorization of access to data in a network, and covers a variety of computer networks; conducting transactions and communications among businesses, government agencies and individuals. Networks can be private, such as within a company, and others which might be open to public access.